Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    file.exe
  • Size 316KB
  • Sample221121-stk51afd39
  • SHA256 3a61280726d90b185f70884c4f7ff84af52be06f7fa2ceebf16065e8aee4feb6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookxloaderpgntloaderratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • pgnt

Decoy

  • 0WG18LbM4lR9iqMRa4nlBzTb

  • jcfGYzPgZTqFZVO9FV2yIw==

  • laIfrdSC8/4CNg==

  • Q73ilev5GIWuOrAAFV2yIw==

  • Q2u/pMw7pv4sPA==

  • TbqvIUHwlQscPo0HFV2yIw==

  • 8PNWfGPyE8n0IQ==

  • WtgROxXzvY2L

  • PryaRBNjm4eP

  • Y9Hdi06Cry1um9Sj68YAu1o=

  • 3Gulyp7CMQtR78jvLkk=

  • JJ3GasTVTCRQT6Tfz6S6GlI=

  • RnS42bhb9tI0R6UpD6wOxriNxw==

  • he1mi2sOGfzTRGHnuA==

  • eaYjCtjxVjdU5XLRtBMBLKk9quA=

  • k9rTeEqYzzw8WaTfz6S6GlI=

  • 5luVQwe2vJWKEAiMdF4=

  • MGW14L9OVk5Y5TaR6w/DqdhYxXVY

  • mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==

  • y5klhuMbE8n0IQ==

Extracted

Family

  • xloader

Version

  • 3.�E

Campaign

  • pgnt

Decoy

  • 0WG18LbM4lR9iqMRa4nlBzTb

  • jcfGYzPgZTqFZVO9FV2yIw==

  • laIfrdSC8/4CNg==

  • Q73ilev5GIWuOrAAFV2yIw==

  • Q2u/pMw7pv4sPA==

  • TbqvIUHwlQscPo0HFV2yIw==

  • 8PNWfGPyE8n0IQ==

  • WtgROxXzvY2L

  • PryaRBNjm4eP

  • Y9Hdi06Cry1um9Sj68YAu1o=

  • 3Gulyp7CMQtR78jvLkk=

  • JJ3GasTVTCRQT6Tfz6S6GlI=

  • RnS42bhb9tI0R6UpD6wOxriNxw==

  • he1mi2sOGfzTRGHnuA==

  • eaYjCtjxVjdU5XLRtBMBLKk9quA=

  • k9rTeEqYzzw8WaTfz6S6GlI=

  • 5luVQwe2vJWKEAiMdF4=

  • MGW14L9OVk5Y5TaR6w/DqdhYxXVY

  • mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==

  • y5klhuMbE8n0IQ==

Targets

    • Target
      file.exe
    • Size 316KB
    • SHA256 3a61280726d90b185f70884c4f7ff84af52be06f7fa2ceebf16065e8aee4feb6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookxloaderpgntloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks